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DETAILED ACTION 

Response to Arguments 

Applicant's arguments with respect to claims 1-133, 141-143 have been considered but 
are moot in view of the new ground(s) of rejection. 

Claim Objections 

Claim 131 states "Optical Carrier Recognition". This objected to because of the 
following informalities: The examiner believes the applicant meant Optical Character 
Recognition. Appropriate correction is required. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



Claims 1-4. 11, 17, 35, 37, 51, 56-65, 69, 70, 73, 86, 87, 91-99 and 109-112, 125-128 is 
rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 6,732,149 in 
view of Anderson US 5,805,674 in view of Faccin 2001/0049790 
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As per claims 1-4, 11,51,56-65,69,70,91-99, 109, 110, 111, 112, 125, 128, 132 
Kephart teaches a signature extractor to extract a signature from monitored data, (Col 1 1 
lines 45-48). Kephart teaches a database of preobtained signatures, (Col 9 lines 55-60). 
Kephart teaches the content is internally generated previous to extracting (generating a 
message). Kephart teaches a comparator for comparing the comparing the extracted 
signature with the signature from the database, (Col 1 1 lines 50-60). Kephart teaches the 
comparison searches for predetermined content, (Col 10 lines 39-55). Kephart teaches a 
decision making unit for producing an enforcement decision, (Col 16 lines 19-35). 
Kephart teaches prevention of transmitting certain content over a network to control 
distribution, (Col 10 lines 7-15). Kephart teaches a confidence level to decide (levels of 
matching) (Col 15 line 55 to Col 16 line 35). Kephart teaches the network is an 
organizational network (Company A) (Fig 2). 

Anderson teaches incrementing a security level each time a match is found (claim 3). 
It would have been obvious to one of ordinary skill in the art to increment based on 
previous detections because it allows increased security. 

Faccin teaches varying bandwidth according to security precautions [0030] 

It would have been obvious to one of ordinary skill in the art to control bandwidth based 

on security because it allows the security system to prevent the spread of malicious code. 

As per claim 17, Kephart teaches the system is used to extract signatures from messages 
or emails (multimedia) , (Col 10 lines 5-10). 
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As per claims 35, and 37, Kephart teaches hashing, (Col 1 1 lines 50-55). 

As per claim 126-128, Kephart teaches a signature extractor to extract a signature from 
monitored data, (Col 1 1 lines 45-48). Kephart teaches a database of preobtained 
signatures, (Col 9 lines 55-60). Kephart teaches the content is internally generated 
previous to extracting (generating a message). Kephart teaches a comparator for 
comparing the comparing the extracted signature with the signature from the database, 
(Col 1 1 lines 50-60). Kephart teaches the comparison searches for predetermined 
content, (Col 10 lines 39-55). Kephart teaches a decision making unit for producing an 
enforcement decision, (Col 16 lines 19-35). Kephart teaches prevention of transmitting 
certain content over a network to control distribution, (Col 10 lines 7-15). 
Kephard teaches the content is not sent out of the network because if a signature is found 
on an inbound or outbound scan, an action is taken including automatically deleting, (Col 
5 lines 60-67, Col 16 lines 20-25). ). Kephart teaches a confidence level to decide 
(levels of matching) (Col 15 line 55 to Col 16 line 35). Kephart teaches reporting events 
at a local endpoint (user A) (Col 9 lines 45-50). Kephart teaches adding a message to 
matching data (labeling as undesirable) (Col 7 lines 48-55). 

As per claim 73 Kephart teaches the system is used to extract signatures from messages 
or emails (multimedia) , (Col 10 lines 5-10). 

As per claims 86, 87 Kephart teaches hashing, (Col 1 1 lines 50-55). 
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Claims 5 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Anderson US 5,805,674 in view of Faccin 2001/0049790 

in view of Barton US 5,646,997. 

As per claim 5, Kephart does not teach meta information. 

Barton teaches deriving a signature from meta information, (Claim 14) 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the meta-data of Barton so that the signature is secure and can't be 
modified, (Col 3 lines 48). 

Claims 6-9, are rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart 
US 6,732,149 in view of Anderson US 5,805,674 in view of Faccin 2001/0049790 in 
view of Vaidya US 6,279,113. 

As per claims 6-9, Kephart teaches extracting a signature from data, (Col 1 1 lines 45-48). 
Kephart does not teach the multi-level security. 

Vaidya teaches examining every layer to extract a signature, (Col 7 lines 15-24). It 
would be obvious to one of ordinary skill in the art to modify the system of Kephart with 
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the multiple layers of Vaidya because it is advantageous to be able to detect a signature in 
any level, (Col 4 lines 28-33). 

Claim 10 rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Vaidya US 6,279,1 13 in view of Barton US 5,646,997. 

As per claims 10 Kephart teaches extracting a signature from data, (Col 1 1 lines 45-48). 
Kephart does not teach the multi-level security. 

Vaidya teaches examining every layer to extract a signature, (Col 7 lines 15-24). It 
would be obvious to one of ordinary skill in the art to modify the system of Kephart with 
the multiple layers of Vaidya because it is advantageous to be able to detect a signature in 
any level, (Col 4 lines 28-33). 

Barton teaches deriving a signature from meta information, (Claim 14) 

It would have been obvious to one of ordinary skill in the art to modify the previous 
system of Kephart- Vaidya with the meta-data of Barton so that the signature is secure and 
can't be modified, (Col 3 lines 48). 

Claims 12-14, 143 rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Anderson US 5,805,674 in view of Faccin 
2001/0049790 in view of Kirby US 5,898,784. 

As per claim 12, Kephart does not specifically teach a packet network. 

Kirby teaches that the network is composed of passing packets, (Col 4 lines 3-7). 
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It would have been obvious to one of ordinary skill in the art to use the packet network of 
Kirby with the data monitoring of Kephart, so because the method of packet switching 
has high efficiency for digital data networking. 

As per claims 13, and 14, 143, Kephart does not specifically teach extracting a signature 
from the header of a packet. 

Kirby teaches extracting a signature from the packet header, (Col 5 lines 13-20). 
It would have been obvious to one of one of ordinary skill in the art to be able to monitor 
the headers of Kirby in the system of Kephart because it allows signature checking 
without decryption. 

Claims 15 and 16, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Anderson US 5,805,674 in view of Faccin 
2001/0049790 in view of Schlener US 6,182,157. 

As per claims 15 and 16, Kephart does not teach software agents. 

Kephart teaches software agents monitoring a number of nodes, (Col 4 lines 3-6, Fig 1). 

It would have been obvious to one of ordinary skill in the art to use the software agents of 
Schlener with the system of Kephart because software agents are independent and 
autonomous. 



Application/Control Number: 1 0/003 ,269 Page 8 

Art Unit: 2434 

Claims 18-23, 41, 42, and 48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Anderson US 5,805,674 in view 
of Faccin 2001/0049790 in view of Vogel US 6,055,663. 

As per claims 18-23, 41, 42, and 48 Kephart teaches taking signatures from multimedia 
data (Col 10 lines 5-10). Kephart does not teach analyzing and combining data into a 
single communication. 

Vogel teaches analyzing and combining two packet signals into a single channel, (Col 2 
lines 35-45). It would have been obvious to one of ordinary skill in the art to modify the 
system of Kephart with the communication method of Vogel because it provides 
advantageous error-protection, (Col 2 lines 18-23). 



Claims 24-26, 113, 114, and 119-124, 133, are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Kephart US 6,732,149 in view of Anderson US 5,805,674 in 
view of Faccin 2001/0049790 in view of Moskowitz US 2002/0071556. 

As per claims 24-26, 1 13, 1 14, and 1 19-124, 133 Kephart does not teach compression. 

Moskowitz teaches a signature used in compressed data. Moskowitz teaches 
stegonography, [0020]. 

It would have been obvious to modify the system of Kephart with the compression of 
Moskowitz because it allows faster file transfer. 
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Claims 27-30, 67, 68, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Anderson US 5,805,674 in view of Faccin 
2001/0049790 in view of Thomlinson US 6,389,535. 

As per claims 27-30, 67, 68, Kephart does not teach entropy and encryption. 

Thomlinson teaches use of entropy and encryption, (Claim 7, 8). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the encryption of Thomlinson because it enhances security. 

Claims 31-34, 39, 40, are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Anderson US 5,805,674 in view of Faccin 
2001/0049790 in view of Rhoads US 2002/0012443. 

As per claims 3 1-34, 39, 40, Kephart teaches signature extraction, Kephart does not teach 
a media player with a format detector. 

Rhoads teaches a media player with format detection, and audio and video data [0087] 
[0052], [0041]. 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the playback device of Rhoads, because Rhoads provides portability. 
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Claims 36 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Anderson US 5,805,674 in view of Faccin 2001/0049790 in view 
of Verhoorn III US 6,725,371. 

As per claim 36, Kephart does not teach a buffer. 

Verhoorn III teaches using a buffer associated with a signature extractor from packet 
data, (abstract). It would have been obvious to one of ordinary skill in the art to modify 
the system of Kephart with the buffer or Verhoorn III because the buffer allows multiple 
packets to be stored and processed. 

Claim 38, is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Anderson US 5,805,674 in view of Faccin 2001/0049790 in view 
ofRobison US 5,043,885. 

As per claim 38, Kephart does not teach a hash with offset. 

Robinson teaches a hashing system with offset, (Col 6 lines 15-25). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the hashing of Robinson because it provides a way to index data. 



Application/Control Number: 1 0/003 ,269 Page 1 1 

Art Unit: 2434 

Claims 43-47, 49, 50, 52-55, 66, are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Anderson US 5,805,674 in view 
of Faccin 2001/0049790 in view of Hile US 5,319,776. 

As per claims 43-47, 49, 50, Kephart teaches comparing signatures to get the best result. 
Kephart does not teach multiple tests for signatures. 

Hile teaches multiple tests for signatures, (Col 1 lines 55-60). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the multiple testing of Hile because it provides redundancy. 

As per claims 52-55, 66, Kephart teaches comparing signatures and checking 
probabilities of matching with other comparisons, (Col 1 1 line 64-Col 12 line 5). 



Claims 71, and 72 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Anderson US 5,805,674 in view of Faccin 
2001/0049790 in view of Schlener US 6,182,157. 



As per claims 71, and 72 Kephart- does not teach software agents. 

Kephart teaches software agents monitoring a number of nodes, ( Kephart Col 4 lines 3-6, 
Fig 1). 
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It would have been obvious to one of ordinary skill in the art to use the software agents of 
Schlener with the system of Kephart because software agents are independent and 
autonomous. 

Claims 79-82, 100, 101, 102, 129, 130 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Anderson US 5,805,674 in view 
of Faccin 2001/0049790 in view of Thomlinson US 6,389,535. 

As per claims 79-82, 100-102, 129, 130 Kephart does not teach entropy and encryption. 

Thomlinson teaches use of entropy and encryption, (Claim 7, 8). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the encryption of Thomlinson because it enhances security. 

Claims 83, 84, 85, 89, 90, 141 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kephart US 6,732,149 in view of Anderson US 5,805,674 in view 
of Faccin 2001/0049790 in view of Rhoads US 2002/0012443. 

As per claims 83, 84, 85, 89, and 90, 141 Kephart teaches signature extraction, Kephart 
does not teach a media player with a format detector. 

Rhoads teaches a media player with format detection, and audio and video data [0087] 
[0052], [0041]. Rhoads teaches prevention of copying content onto portable media 
[0084]. 
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It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the playback device of Rhoads, because Rhoads provides portability. 

Claim 88 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart US 
6,732,149 in view of Anderson US 5,805,674 in view of Faccin 2001/0049790 in view 
ofRobison US 5,043,885. 

As per claim 88, Kephart does not teach a hash with offset. 

Robinson teaches a hashing system with offset, (Col 6 lines 15-25). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the hashing of Robinson because it provides a way to index data. 

Claims 103-108 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kephart US 6,732,149 in view of Anderson US 5,805,674 in view of Faccin 
2001/0049790 in view of GUPTA WO 99/63727. 

As per claims 103-108, Kephart does not teach firewalls or trust networks. 

Gupta teaches a system of firewalls to protect a trusted network, (Abstract). 

It would have been obvious to one of ordinary skill in the art to modify the system of 
Kephart with the firewall of Gupta because firewalls enhance the security of the network. 
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Claims 131 is rejected under 35 U.S.C. 103(a) as being unpatentable over Kephart 
US 6,732,149 in view of Daniele US 5,444,779 

As per claims 131 Kephart teaches a signature extractor to extract a signature from 
monitored data, (Col 1 1 lines 45-48). Kephart teaches a database of preobtained 
signatures, (Col 9 lines 55-60). Kephart teaches the content is internally generated 
previous to extracting (generating a message). Kephart teaches a comparator for 
comparing the comparing the extracted signature with the signature from the database, 
(Col 1 1 lines 50-60). Kephart teaches the comparison searches for predetermined 
content, (Col 10 lines 39-55). Kephart teaches a decision making unit for producing an 
enforcement decision, (Col 16 lines 19-35). Kephart teaches prevention of transmitting 
certain content over a network to control distribution, (Col 10 lines 7-15). Kephart 
teaches a confidence level to decide (levels of matching) (Col 15 line 55 to Col 16 line 
35). Kephart teaches the network is an organizational network (Company A) (Fig 2). 

Daniele teaches a networked photocopier, (Fig 7). Daniele teaches Optical Character 
Recognition to control the output of a photocopier. (Col 9 lines 40-65, Col 5 lines 20-35, 
Col 1 1 line 30-40). 

It would have been obvious to use the optical character recognition of Daniele with the 
content monitoring of Kaphart in order to prevent illegal reproduction of documents. 



Application/Control Number: 1 0/003 ,269 Page 1 5 

Art Unit: 2434 

Allowable Subject Matter 

Claim 142 is allowed. Claim 142 is allowable over the prior art of record because it 
allows trustworthy data sources to pass without monitoring. 



Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to CHRISTOPHER J. BROWN whose telephone number is 
(571)272-3833. The examiner can normally be reached on 8:30-6:00. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on (571)272-381 1. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Christopher J Brown/ 2/22/09 
Primary Examiner, Art Unit 2434 



